Policía de Salta

Summary

Following the compromise of an official social media account belonging to a Salta provincial police force, the General Directorate of Cybersecurity activated digital security protocols and launched an investigation to address the breach. The specialized team successfully regained control of the affected Facebook page, restored its security configurations, and removed unauthorized content that had been posted by the attacker. Once the account was fully recovered, the organization communicated the resolution to the public and encouraged community members to resume following and engaging with the official fanpage for institutional updates.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

A cyber incident involving the official social media presence of the Policía de Salta came to public attention after the institution's Facebook account was compromised by unauthorized actors. The Dirección General de Ciberseguridad, the specialized unit within the provincial security apparatus responsible for digital investigations, confirmed that the fanpage had been successfully hijacked weeks before the public restoration announcement. The initial detection of the intrusion set in motion a coordinated response that combined technical remediation with formal investigative procedures. The exact date on which the attackers first gained control of the account is not specified in the available reporting, but the gap between the compromise and the eventual recovery suggests that the process demanded sustained engagement with both internal protocols and external platform stakeholders. Once the breach was identified, the affected account was treated as an active security incident, with the compromised credentials and unauthorized access pathways requiring systematic neutralization.

In response to the intrusion, the Dirección General de Ciberseguridad activated established digital security protocols designed to contain the damage and preserve evidence. The specialized team undertook a multi-stage recovery operation that included reclaiming administrative control of the fanpage, restoring the integrity of the account's security configuration, and removing content that had been posted by the attackers without authorization. Throughout the period in which the account remained outside the institution's control, the compromised page was used to disseminate material that did not originate from official Police of Salta communications, creating a risk of misinformation reaching the account's followers. The successful reassertion of administrative control over the page marked the conclusion of the recovery phase, after which the institution was able to resume its normal pattern of publishing institutional information through the verified channel. The Dirección General de Ciberseguridad's handling of the case reflects a structured approach to social media account compromise, treating it as a matter of digital security rather than a mere public relations inconvenience.

The incident had tangible operational and reputational consequences for the Policía de Salta during the period in which the account remained outside the institution's control. Followers and members of the public who relied on the fanpage as an authoritative source of information from the provincial police force were temporarily exposed to content that the institution had not sanctioned and could not vet. The very fact that the breach was reported as having occurred "weeks" before recovery indicates that the window of unauthorized access was significant, increasing both the volume of unapproved content that could be circulated and the difficulty of containing its spread once posted. The Policía de Salta acknowledged the disruption implicitly by thanking the community for their patience and companionship throughout the recovery process, signaling that public interaction with the page was suspended or curtailed while the technical team worked to restore legitimate control. Once the recovery was completed, the institution issued a public communication directing followers back to the official fanpage under the name Policía de Salta, where normal institutional communications would resume.

The response from the Dirección General de Ciberseguridad illustrates the procedural framework applied to social media account takeovers within the Salta provincial security structure. The activation of digital security protocols, the conduct of a formal investigation, and the eventual restoration of the account all fall within the unit's documented responsibilities. The recovery operation required coordination with the Facebook platform itself, since reclaiming control of a compromised page typically involves identity verification, removal of unauthorized administrators, and reset of authentication credentials through official support channels. The removal of unauthorized publications was treated as a distinct phase of the response, indicating that the attackers had actively used the account to post content rather than merely holding it dormant. The institution's public statement emphasized that access had been recovered, security had been restored, and unapproved publications had been eliminated, providing the community with a clear indication that the page was once again under legitimate management.

The timeline of the incident, as reconstructed from the available reporting, places the compromise prior to early April 2025, with the recovery and public announcement occurring on or around April 1, 2025. During the intervening weeks, the Policía de Salta was unable to use its primary Facebook presence to communicate with the public, likely relying on alternative channels to maintain institutional visibility while the recovery effort proceeded. The successful conclusion of the operation allowed the force to resume its social media activities and to re-engage with the follower base that had remained attached to the page throughout the disruption. The incident underscores the vulnerability of official institutional accounts to targeted intrusion and the importance of specialized response capabilities, in this case embodied by the Dirección General de Ciberseguridad, in restoring trust and operational continuity after a takeover event.

Sources

Sources available to members: 1 source.